Which technique involves injecting into the memory of a running process to propagate and re-inject (as described with local shellcode injection, remote thread injection, and process hollowing)?

Which technique involves injecting into the memory of a running process to propagate and re-inject (as described with local shellcode injection, remote thread injection, and process hollowing)?

• A. Memory code injection
• B. Process hollowing
• C. Registry manipulation
• D. Malware persistence

Answer: (A)

Memory code injection is the technique of inserting and executing code inside the memory space of a running process. When attackers use local shellcode injection, remote thread injection, or process hollowing, they are all applying this same idea: get code to run within another process so it operates with that process’s privileges and context. Local shellcode injection writes and runs payload within the same process; remote thread injection uses a handle to another process to start execution there; process hollowing starts a new process in a suspended state and replaces its memory with malicious code so the process runs the attacker’s code as if it were the legitimate one. This approach is powerful because it blends malicious activity into legitimate process execution, making detection and containment more challenging. Registry manipulation is about altering Windows registry keys for persistence or behavior changes, not about injecting code into a running process. Malware persistence is a broader objective describing how malware remains on a system, not the specific technique of injecting code into process memory. Process hollowing, while a form of memory code injection, is a specific method under that umbrella, whereas the question points to the wider technique that encompasses these memory-injection techniques.

Memory code injection is the technique of inserting and executing code inside the memory space of a running process. When attackers use local shellcode injection, remote thread injection, or process hollowing, they are all applying this same idea: get code to run within another process so it operates with that process’s privileges and context. Local shellcode injection writes and runs payload within the same process; remote thread injection uses a handle to another process to start execution there; process hollowing starts a new process in a suspended state and replaces its memory with malicious code so the process runs the attacker’s code as if it were the legitimate one. This approach is powerful because it blends malicious activity into legitimate process execution, making detection and containment more challenging.

Registry manipulation is about altering Windows registry keys for persistence or behavior changes, not about injecting code into a running process. Malware persistence is a broader objective describing how malware remains on a system, not the specific technique of injecting code into process memory. Process hollowing, while a form of memory code injection, is a specific method under that umbrella, whereas the question points to the wider technique that encompasses these memory-injection techniques.